Method, Device and System For Verifying Points Determined on an Elliptic Curve

ABSTRACT

Conventional cryptographic methods that are based on elliptic curves are prone to side-channel attacks. Previously known methods for preventing side-channel attacks have the disadvantage of requiring high arithmetic capacity and a large amount of available memory space. The proposed method overcomes said disadvantage by using a process for verifying points on elliptic curves which saves arithmetic capacity and memory space.

CROSS REFERENCE TO RELATED APPLICATIONS

This application is based on and hereby claims priority to GermanApplication No. 10 2006 002 891.0 filed on Jan. 20, 2006 and PCTApplication No. PCT/EP2006/068919 filed on Nov. 27, 2006, the contentsof which are hereby incorporated by reference.

BACKGROUND OF THE INVENTION

The invention relates to a method, a device and a system for verifyingpoints determined on an elliptic curve.

Cryptographic techniques based on elliptic curves are very efficient;the particular reason for this is that unlike previously knowncryptographic techniques, there are no known attack methods having asubexponential running time for these techniques. In other words, thismeans that the increase in security per bit of the security parametersused is greater for techniques based on elliptic curves, and hencesignificantly shorter key lengths can be used for practicalapplications.

Hence cryptographic techniques based on elliptic curves have a higherperformance and require a smaller bandwidth to transmit the systemparameters than other cryptographic techniques with a comparable levelof achievable security.

The known Diffie-Hellman technique for shared-key agreement between twocommunications users based on elliptic curves shall be outlined here asan example. In this technique, the first communications user A knows asecurity parameter r_(a) and the second communications user B knows asecurity parameter r_(b). Once the two communications users have agreedon an elliptic curve and on a shared point P on this elliptic curve, thecommunications user A determines a value

Q _(a) =r _(a) *P

and the communications user B determines a value

Q _(b) =r _(b) *P.

Then the communications user A sends the value Q_(a) to thecommunications user B, and the communications user B sends the valueQ_(b) to the communications user A. In a further scalar multiplication,the communications user A now determines the shared key

K=r _(a) *Q _(b) =r _(a) *r _(b) *P

and the communications user B determines the same shared key

K=r _(b) *Q _(a) =r _(b) *r _(a) *P.

These scalar multiplications thus form a fundamental component ofcryptographic techniques based on elliptic curves. The use of ellipticcurves is particularly advantageous because the inverse operation

r _(a,b) =Q _(a,b) /P

can only be calculated using a considerable amount of computing effort.Based on today's level of knowledge, the scalar multiplication can becomputed in polynomial time, but can only be inverted in exponentialtime.

Known cryptographic techniques based on elliptic curves are prone toviolation by “side-channel attacks”, however.

Side-channel attacks are a class of methods for cryptographic analysis.Unlike conventional attacks on cryptographic applications, in this casean attacker does not attempt to break the underlying abstractmathematical algorithm, but attacks a specific implementation of acryptographic technique. To do this, the attacker uses easily accessiblephysical measured quantities of the specific implementation, such as thecomputation running time, the power consumption and the electromagneticradiation of the processor during the computation, or the response ofthe implementation to induced errors. The physical measurements from asingle computation can be analyzed directly, for example in a simplepower analysis, SPA, or an attacker records the measurements from aplurality of computations using a storage oscilloscope, for example, andthen performs a statistical analysis, for example in a differentialpower analysis, DPA. Side-channel attacks are often far more efficientthan crypto-analytic techniques and may even break techniques that areconsidered secure in terms of the algorithm, if the implementation ofthese algorithms is not protected against side-channel attacks. Hence ithas been recognized that the actual implementation of cryptographictechniques based on elliptic curves is critical to the degree ofachievable security of the respective applications that is ultimatelyobtained. Such measures to counter side-channel attacks are essentialfor smart cards and embedded applications in particular.

“Error analysis” is an example of these side-channel attacks. In thistechnique, an attacker systematically manipulates the operatingparameters of an implementation of a cryptographic technique to causetransient or permanent errors during the cryptographic computation. Theattack is possible because the correct operation of a component, such asa smart card or an embedded system, can only be guaranteed by themanufacturer within preset environmental conditions. Hence there is abroad spectrum of technical opportunities for generating such errors,such as manipulating the clock generation, fluctuations in the supplyvoltage, over-temperature or under-temperature, flashes of light orselective interference using a laser, partial destruction of theelectric circuits, high-level radiation etc. The differences betweenoutputs from the circuit during correct and faulty operation can providean attacker with information on secret data, for instance on secretkeys, depending on the error model used in the implementation. With somecryptographic techniques, a single incorrect computational result isenough to result in the secret key being divulged immediately.Security-related implementations must therefore include suitablecountermeasures to protect against error analysis.

Previously known countermeasures range from sensors that monitor theenvironmental conditions and prevent execution of the cryptographiccomputations in the event of inadmissible operating conditions, toalgorithmic protective measures. Algorithmic protective measures, forexample, can perform the cryptographic computation twice and compare thetwo results with each other. This has the disadvantage, however, oftwice the computing effort and consequently at least double thecomputing time. In another known countermeasure to protect against erroranalyses, invariants are introduced in intermediate results of thecryptographic technique that must remain intact throughout the entirecomputation. Before the result of the computation is output, the devicechecks whether the invariant is still valid at the end of thecomputation. If an error occurred, it is extremely likely that theinvariant is no longer satisfied. Once again, however, this method hasthe disadvantage that a plurality of additional computing steps need tobe made and hence high demands are placed on the required computingcapacity and available memory space.

In certain environments on which cryptographic techniques are to beimplemented, such as smart cards or RFID chips, however, it is necessaryto allow for specific requirements as regards available computingcapacity and existing memory space. In these environments, however, theaforementioned techniques for defending against side-channel attacks, inparticular against error analyses, have the disadvantage that theycannot be used in such systems because they require a large amount ofcomputing capacity and available memory space.

SUMMARY

Hence it is one potential object to provide a method, a device and asystem for defending against side-channel attacks, in particularside-channel attacks based on error analyses, that achieve a furtherreduction in the computing-time requirement and a reduction in thememory space needed compared with previously known solutions.

The inventors propose that an elliptic curve is provided in a method toverify points determined on an elliptic curve. At least one coordinateof at least one first point lying on the elliptic curve is selected ordetermined. This first point is multiplied by a scalar according to adefined method, with just one coordinate of the first point being usedin the entire defined method. Further points are obtained as a result ofthe scalar multiplication, said points comprising at least onecoordinate of the respective result of the first point multiplied by thescalar and of the first point multiplied by a scalar increased by avalue. The determined points hence comprise the first point and theadditional points. The determined points are then verified to establishwhether they can lie on a straight line. The determined points areidentified as verified if they can lie on a straight line.Advantageously, the method is suitable for being used in environmentshaving limited processor resources, because determining whether thedetermined points lie on a straight line takes little computing effort.

A polynomial for verifying the determined points is preferablyevaluated, with the evaluation of the polynomial producing one specificvalue precisely when the points to be verified lie on a straight line.This has the advantageous effect that the verification method can managewith even fewer multiplications and additions and hence the requiredcomputing effort is further reduced.

According to another advantageous embodiment, the determined points areverified after a definable number of fully processed bits of the scalar.This has the advantage that verification can be performed after eachstep of the algorithm, thereby further increasing the security, or, forexample, verification can be performed only after execution of thealgorithm in order to increase thereby the speed of the scalarmultiplication.

According to the device for verifying points determined on an ellipticcurve, the device comprises means that are configured such that thefollowing method can be performed: an elliptic curve is provided and atleast one coordinate of at least one first point on the elliptic curveis selected or determined. The first point is multiplied by a scalaraccording to a defined method, with just one coordinate of the firstpoint being used in the entire defined method.

Further points are obtained as a result of the scalar multiplication,said points comprising at least one coordinate of the respective resultof the first point multiplied by the scalar and of the first pointmultiplied by a scalar increased by a value. The determined points hencecomprise at least the first point and the additional points. Thedetermined points are then verified to establish whether they can lie ona straight line, with the determined points being identified as verifiedif they can lie on a straight line.

According to the system for verifying points determined on an ellipticcurve, said system comprising a first processor and a second processor,it is possible to connect together the first processor and the secondprocessor. First, an elliptic curve and at least one coordinate of atleast one first point lying on the elliptic curve are agreed between thefirst processor and the second processor. The first processor comprisesa processor unit, which is configured such that the following method canbe performed: the first point is multiplied by a scalar according to adefined method, with just one coordinate of the first point being usedin the entire defined method. Further points are obtained as a result ofthe scalar multiplication, said points comprising at least onecoordinate of the respective result of the first point multiplied by thescalar and of the first point multiplied by a scalar increased by avalue. The determined points hence comprise at least the first point andthe additional points. The determined points are then verified toestablish whether they can lie on a straight line. The determined pointsare identified as verified if they can lie on a straight line. Thedetermined and verified points are transmitted from the first processorto the second processor, with just the one coordinate of the respectivepoint being sent for each of the points located on the elliptic curve.The second processor comprises a processor unit, which is configuredsuch that the following method can be performed: the points transmittedfrom the first processor are received, and the received, determinedpoints undergo additional processing, with just the one coordinate ofthe respective point on the elliptic curve being used in the entireadditional processing.

BRIEF DESCRIPTION OF THE DRAWINGS

These and other objects and advantages of the present invention willbecome more apparent and more readily appreciated from the followingdescription of the preferred embodiments, taken in conjunction with theaccompanying drawing of which:

FIG. 1 shows a schematic diagram of an elliptic curve over real numbers.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT

Reference will now be made in detail to the preferred embodiments of thepresent invention, examples of which are illustrated in the accompanyingdrawing, wherein like reference numerals refer to like elementsthroughout.

An elliptic curve E is generally described by a cubic equation of thefollowing form:

y ² +a ₁ *x*y+a ₃ *y=x ³ +a ₂ *x ² +a ₄ *x+a ₆,

where a₁, a₂, a₃, a₄, a₆ are fixed elements of a finite field K thatparameterize the elliptic curve E. It should be noted in this contextthat, depending on the characteristic of the field K, the curve equationof the elliptic curve E can be transformed onto simpler curve equations.

As already mentioned above, the scalar multiplication of curve points ofthe elliptic curve by integers forms the basis of all cryptographictechniques based on elliptic curves. Suppose S is an integer, P a pointon the elliptic curve E and Q=n*P is the n-multiple of the point P. Ifthe points P and Q are given, then the computation of a suitable scalarn, where Q=n*P, is referred to as the discrete logarithmic problem forelliptic curves. With a suitable choice of the finite field K and theparameters of the elliptic curve E, it is not possible using currentalgorithms to solve the discrete logarithmic problem within a reasonabletime.

A point P of elliptic curve E is defined by its x-coordinate and itsy-coordinate. By virtue of the curve equation of the elliptic curve E, amaximum of two different y-values y₁ and y₂ exist for one x-value, sothat the points (x,y₁) and (x,y₂) are points on the elliptic curve E.Hence, in order to define a point on the elliptic curve E uniquely, justone more bit of additional information is required apart from thex-coordinate.

In the case of an elliptic curve E over finite prime fields, the leastsignificant bit (LSB) of the y-coordinate or the sign of they-coordinate at the respective point suffices as the additionalinformation, for example.

These properties of elliptic curves are made use of in the Montgomeryladder algorithm, which is an established method for implementing scalarmultiplication on elliptic curves. The Montgomery ladder algorithm canbe implemented in such a way that just the x-coordinate of a point P isused to compute the x-coordinate of a scalar multiple of P. Since theMontgomery ladder method is also an excellent way of counteractingsimple power analyses, it is often implemented in cryptographic systemsrunning on embedded systems.

According to the method described below of a Montgomery ladderalgorithm, a multiple n*P of a point P located on an elliptic curve iscomputed.

The scalar n=(n₁, . . . , n_(l)), given in binary form, is processedbit-by-bit starting with the most significant bit (MSB, N1).

Suppose below that u_(i) denotes the value of the binary form (n₁, . . .n_(l)) for all i from 1 to l. In the respective i-th round, (i-thiteration), the points Q_(i)=u_(i)*P and R_(i)=(u_(i)+1)*P arecalculated as intermediate results according to the following rule,which is presented in a pseudocode:

In the first subroutine presented above, the value O is initiallyassigned to an initialization point Q₀, which is equivalent toinitializing this variable.

In an additional initialization step, the value of the point P isassigned to an additional variable R as the initialization variable R₀.

In an additional step, in the actual computation loop, in each iterationin which the respective scalar value n_(i) for that iteration has thevalue 1, the sum of the value of the first intermediate variable Q_(i−1)of the previous iteration i−1 and the value of the second intermediatevariable R_(i−1) of the previous iteration i−1 is assigned to the valueof a first intermediate variable Q of the iteration i (denoted byQ_(i)). Twice the value of the second intermediate variable of theprevious iteration i−1 is assigned to the value of the secondintermediate variable R_(i) in the iteration i.

If the value of the scalar n_(i) does not equal 1, the sum of the valuesof the sum of the first intermediate variable R_(i−1) in the previousiteration i−1 and the value of the first intermediate variable Q_(i−1)in the previous iteration is assigned to the second intermediatevariable R_(i) in the iteration i. Twice, i.e. double, the value of thefirst intermediate variable Q_(i−1) of the previous iteration isassigned to the first intermediate variable Q_(i) of the iteration i.

In the pseudocode described above, the resulting value of theintermediate variable Q_(i) in the last iteration I is output as theresult value of this operation, when all the scalar values n_(i) of thescalar n have been processed. Optionally, the intermediate variablesR_(i) and Q_(i) can be output as an intermediate result value after eachiteration or after a definable number of iteration steps. When theresults are computed without error in the Montgomery ladder algorithm,the intermediate variables after each iteration step exist in the form

R _(i)=(u _(i)+1)·P and Q _(i) =u _(i) ·P

said variables differing only by the point P.

Accordingly, the Montgomery ladder simultaneously computes thex-coordinates of the points n*P and (n+1)*P. Since the y-coordinate ofthe difference of the two results is known, the complete point n*P canbe reconstructed at the end of the loop from the computed x-coordinates.

This is used as the basis for a simple method for protecting a scalarmultiplication on elliptic curves that tests at the end of thecomputation whether the result still constitutes a point on the ellipticcurve. This simply involves verifying whether the coordinates of theresult point satisfy the equation of the elliptic curve.

In certain environments on which cryptographic methods are to beimplemented, such as smart cards or RFID chips, however, it is necessaryto allow for specific requirements as regards available computingcapacity and existing memory space. In these environments, however, themethod described above for verifying the determined points on theelliptic curve has the disadvantage that a complete reconstruction ofthe result point and subsequent substitution in the elliptic curveequation makes considerable demands on the existing processor structureand hence significantly increases the required computing time.

Another method for verifying determined points on an elliptic curveequation based on the Montgomery ladder algorithm would be to dispensewith the y-coordinates, so that in this case, after substituting thex-coordinate, it is necessary to verify whether a quadratic equation iny can be solved. This method also has a fundamental disadvantage that itcannot be implemented in systems having limited computing resources.

The method for verifying points determined on an elliptic curve isdescribed in greater detail below in an exemplary embodiment.

According to the addition law of the elliptic curve, it follows thatwhen the results are computed without errors, the points u_(i)−P,−(u_(i)+1)−P and P lie on a straight line.

This is shown by way of example in FIG. 1. FIG. 1 shows an ellipticcurve 1, in which the points 2 P₁=P, 3 P₂=n*P and 4 P₁+P₂=(n+1)*P arelabeled. The following is true for these points:

P ₁ +P ₂ =P+n*P=(n+1)*P.

As a consequence of the addition law of the elliptic curve, and as canbe seen in FIG. 1, the points P₁, P₂ and −(P₁+P₂) lie on a straight line5. This phenomenon is used in the method to verify determined points onan elliptic curve. A quadratic polynomial is used for this purpose. Ifthis quadratic polynomial is now satisfied for the determinedcoordinates of the points of the Montgomery ladder algorithmP₁+P₂=R_(i)=(u_(i)+1)·P, P₂=Q_(i)=u_(i)·P and P₁=P, the determinedpoints are identified as verified.

In an attack causing erroneous results of the scalar multiplication, anattacker makes a targeted attempt to induce an error inside theMontgomery ladder. For a smart card or a RFID chip this is done bytemperature or voltage changes, by exposure to radiation etc. forexample. If the error is not induced until inside the computation of theMontgomery ladder, there are primarily two different cases to consider.

In the first case, the induced error has the effect that the resultafter a pass through the loop within the Montgomery ladder is not avalid point on the curve. This means that at least one of the tworesults R_(i) and Q_(i) does not have an x-coordinate of a point on theelliptic curve. In this case, the test using the quadratic polynomialwill uncover this error.

In the second case, although an error is induced successfully, theresults still continue to have valid x-coordinates of points on theelliptic curve. In this exemplary embodiment, we assume that the inputbefore the error is u_(i)·P and (u_(i)+1)·P. After the next pass throughthe loop, assuming that the error is induced in the first components,the output obtained is n′·P and (2u_(i+1)+2)·P or n′·P and(2u_(i+1)+1)·P respectively, depending on the value of the processedbit. It follows that these two results no longer differ by P, and hencethe points P, n′·P and −(2u_(i+1)+2)·P or −(2u_(i+1)+1)·P respectivelycan no longer lie on a straight line. Hence the quadratic polynomialwill also uncover this error in this case.

This method for efficient verification of the integrity of a computingresult forms an important component for formulating error resistant,asymmetric, low-cost cryptography protocols that are used in smartcards, RFID chips or embedded systems, for example. Since y-coordinatesare normally dispensed with in these protocols, a test of anx-coordinate to establish whether it is a component of a valid point isonly possible by solving a quadratic equation. This test involvesseveral computationally intensive operations, so it is not suitable fora low-cost protocol. As shown below, the quadratic polynomial can beevaluated using low computing effort, so that this method isparticularly suitable for use in a low-cost application.

Examples of quadratic polynomials are given below that can be used forthe simple verification of the result of a scalar multiplication usingthe Montgomery ladder. The characteristic of the field over which theelliptic curve is defined differs in these examples.

If the characteristic of field K equals 2, the elliptic curve is givenby the equation:

y ² +xy=x ³ +a ₂ x ² +a ₆.

The values x₁, x₂, x₃ can be x-coordinates of points lying on a straightline precisely when the polynomial

p(x ₁ ,x ₂ ,x ₃)=x ₃ ²·(x ₁ +x ₂)² +x ₁ x ₂ x ₃ +x ₁ ² x ₂ ² +a ₆

assumes the value 0. In the projective coordinate representation,x₁=X₁/Z₁, x₂=X₂/Z₂, x₃=X₃/Z₃, and the point at infinity is representedby X≠0 and Z=0. Hence in the projective representation, the followingpolynomial for verification is obtained:

p(X₁, X₂, X₃, Z₁, Z₂, Z₃) = X₃²(X₁Z₂ + X₂Z₁)² + X₁X₂X₃Z₁Z₂Z₃ + X₁²X₂²Z₃² + a₆Z₁²Z₂²Z₃²

If the field K has the characteristic 3, the elliptic curve is given bythe equation:

y ² =x ³ +a ₂ x ² +a ₆

The values x1, x2, x3 can be x-coordinates of points lying on a straightline precisely when the polynomial

p(x₁, x₂, x₃) = x₃²(x₁ − x₂)² ⋅ x₃(x₁x₂(x₁ + x₂ − a₂) − a₆) + x₁²x₂² − a₆(x₁ + x₂ + a₂)

assumes the value 0.

In the projective coordinate representation, the following polynomialfor verification is obtained:

p(X₁, X₂, X₃, Z₁, Z₂, Z₃) = X₃²(X₁Z₂ + X₂Z₁)² + X₃Z₃(X₁X₂(X₁Z₂ + X₂Z₁ − a₂Z₁Z₂) − a₆Z₁²Z₂²) + Z₃²(X₁²X₂² − a₆Z₁Z₂(X₁Z₂ + X₂Z₁ + a₂Z₁Z₂))

If the characteristic of the field K is >3, the elliptic curve is givenby the equation:

y ² =x ³ +a ₄ x+a ₆.

The values x1, x2, x3 can be x-coordinates of points lying on a straightline precisely when the polynomial

p(x₁, x₂, x₃) = x₃²(x₁ − x₂)² − 2x₃(2a₆ + (a₄ + x₁x₂)(x₁ + x₂)) + x₁x₂ − a₄)² − 4a₆(x₁ + x₂)

assumes the value 0.

In the projective coordinate representation, the following polynomialfor verification is obtained:

p(X₁, X₂, X₃, Z₁, Z₂, Z₃) = X₃²(X₁Z₂ + X₂Z₁)² − 2X₃Z₃(2a₆Z₁²Z₂² + (a₄Z₁Z₂ + X₁X₂)(X₁Z₂ + X₂Z₁)) + Z₃²(X₁X₂ − a₄Z₁Z₂)² − 4a₆Z₁Z₂Z₃²(X₁Z₂ + X₂Z₁)

For alternative projective representations, for example Jacobiancoordinates, the representations would need to be modified accordingly.It is already demonstrated here, however, that the verification ofpoints determined on an elliptic curve can be performed using aplurality of multiplications and additions, and is hence characterizedby a considerable reduction in computing effort compared to previouslyknown solutions.

The invention has been described in detail with particular reference topreferred embodiments thereof and examples, but it will be understoodthat variations and modifications can be effected within the spirit andscope of the invention covered by the claims which may include thephrase “at least one of A, B and C” as an alternative expression thatmeans one or more of A, B and C may be used, contrary to the holding inSuperguide v. DIRECTV, 69 USPQ2d 1865 (Fed. Cir. 2004).

1-10. (canceled)
 11. A method for verifying points determined on anelliptic curve, comprising: determining or selecting at least onecoordinate of at least one first point lying on the elliptic curve;multiplying the first point by a scalar according to a defined method toproduce a first result, with one coordinate of the first point beingused in the entire defined method; obtaining further points as a resultof the scalar multiplication, comprising at least: a coordinate of asecond point obtained by multiplying the first point by the scalar; anda coordinate of a third point obtained by multiplying the first point bythe scalar increased by a value; determining whether the first point andthe further points lie on a straight line; and identifying the first andfurther points as verified if the first and further points lie on astraight line.
 12. The method as claimed in claim 11, further comprisingsaving one coordinate for each of the first and further points.
 13. Themethod as claimed in claim 11, wherein the x-coordinate is used as thecoordinate determined or selected for the first point and the coordinateobtained for the further points.
 14. The method as claimed in claim 11,wherein a polynomial is used to determine whether the first and furtherpoints lie on a straight line, and the polynomial produces one specificvalue precisely when the first and further points lie on a straightline.
 15. The method as claimed in claim 14, wherein the polynomialevaluates the coordinates of the first and further points in theprojective and/or affine coordinate representation.
 16. The method asclaimed in claim 11, wherein the scalar exists in binary form, thescalar is processed bit by bit starting with the most significant bit.17. The method as claimed in claim 16, wherein the first and furtherpoints are determined to lie on a straight line after a definable numberof processed bits of the scalar.
 18. The method as claimed in claim 11,wherein the defined method for scalar multiplication is a Montgomeryladder algorithm.
 19. A device for verifying points determined on anelliptic curve in particular according to a method as claimed in claim11, in which the device comprises means that are configured such thatthe following method steps can be performed: a determination device todetermine or select at least one coordinate of at least one first pointlying on the elliptic curve; a multiplier to multiply the first point bya scalar according to a defined method to produce a first result, withjust one coordinate of the first point being used in the entire definedmethod; an increaser to obtain further points each comprising acoordinate obtained by: increasing the scalar by a value; and summingthe first result with a second result obtained by multiplying the firstpoint by the scalar increased by the value; an identifier to determinewhether the first point and the further points lie on a straight lineand identify the first and further points as verified if the first andfurther points lie on a straight line.
 20. A system for verifying pointsdetermined on an elliptic curve, comprising: a first processor; and asecond processor connected to the first processor, wherein an ellipticcurve and a coordinate of a first point lying on the elliptic curve areagreed between the first processor and the second processor, the firstprocessor comprises a processor unit, which is configured to execute amethod comprising: multiplying the first point by a scalar according toa defined method to produce a first result, with one coordinate of thefirst point being used in the entire defined method; obtaining furtherpoints as a result of the scalar multiplication, comprising at least: acoordinate of a second point obtained by multiplying the first point bythe scalar; and a coordinate of a third point obtained by multiplyingthe first point by the scalar increased by a value; determining whetherthe first point and the further points lie on a straight line; andidentifying the first and further points as verified if the first andfurther points lie on a straight line; and transmitting the verifiedpoints from the first processor to the second processor, with just onecoordinate being sent for each point that lies on a straight line, thesecond processor comprises a processor unit, which is configured toexecute a method comprising: receiving the verified points transmittedfrom the first processor; and performing additional processing, withjust one coordinate of each verified point being used in the entireadditional processing.